Ditrax Financial Ltd. (“Ditrax”, “we”, “us”, or “our”) aims to provide fast, cost-efficient, and compliant foreign exchange, crypto-to-fiat conversion solutions, and other financial services to our clients (collectively, the “Services”). This Privacy Policy (the “Policy”) describes how we collect, use, disclose, transfer, retain, and Process the Personal Information of individuals (“you” or “your”) in the course of providing the Services. We collect, use, disclose, transfer, retain, and Process Personal Information only with the individual’s knowledgeable, informed, and voluntary consent, or as otherwise permitted or required by applicable law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy laws. Consent may be express or implied, provided that express consent is obtained for all material purposes, including international transfers outside Canada. Individuals may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. This Policy applies to all individuals whose Personal Information we Process, regardless of their country of residence.

Ditrax understands the importance of your privacy. We take reasonable steps to ensure that all Personal Information in our custody or control is handled in a secure and responsible manner and in conformity with the law. Please review this Policy before using our Services or submitting any Personal Information. If you do not agree with the contents of this Policy, please refrain from using our Services. By accessing or using our website (the “Website”), you indicate that you understand, accept, and consent to the practices described in this Policy. This Policy may change from time to time. Your continued use of this Website after we make changes indicates that you accept and consent to those changes, so please check this Policy periodically for updates. We will notify you in advance of any material changes to this Policy and obtain your consent to any new ways that we collect, use, and disclosure your Personal Information.

1. DEFINITIONS

Whenever used in this Policy, the following words and terms have the meanings set out below:

1. “Personal Information” means any information about an identifiable individual, including but not limited to, name, contact details, date of birth, government-issued identification numbers, financial information, device identifiers, network activity, and any other information that can be used, either alone or in combination with other information, to identify an individual; and
2. “Process” or “Processing” means any operation or set of operations performed on Personal Information, whether by automated means or otherwise, including, collection, use, disclosure, storage, transfer, retention, deletion, and destruction.

2. COLLECTION OF PERSONAL INFORMATION

We may collect Personal Information about you when you register for our Services. Such Personal Information may include:

1. Basic information, such as your name, contact details (such as address, email address and telephone number), date of birth, gender, marital status, citizenship, occupation, and government identification numbers;
2. Financial information, such as transaction history, money transfers, bank account numbers, summaries, or balances, and source and destination of funds for transfers and exchanges;
3. Device identifiers, such as internet protocol (IP) address, unique device ID, device type, browser type, location information, information about your browser, and information about your internet connection, the equipment you use to access our Website, and usage details;
4. Network activity, such as, page views, links and items clicked, browsing history, referring URL, etc.; and
5. Any other category of Personal Information that you voluntarily provide or that is necessary for us to comply with legal, regulatory, or risk-management obligations.

Ditrax may also collect Personal Information about the recipient to whom you send or from whom you receive money, or with whom you otherwise choose to transact with when using the Services.

We only collect Personal Information that is reasonably required for the purposes set out in this Policy. If you wish to refuse the collection of certain Personal Information, you may do so; however, please note that this may limit your ability to use our Services.

We collect your Personal Information in the following manners:

1. Directly from you via electronic communications, interactions with our sales representatives, and use of our Services;
2. Directly from you when you fill out forms on our Website, including using the “contact us” form;
3. From client identification through our third party service provider, Sum and Substance Ltd. (UK) platform, Sumsub;
4. From others through use of our Services; and
5. From automated technologies, including, but not limited to, cookies, as further set out below.

We automatically receive standard technical information when you interact with our Services through our Website, which may constitute Personal Information, including browser and device information, such as unique device identifiers, mobile phone carrier, internet protocol (IP) addresses (which may identify your general geographic location), browser types, and the date and time of your interactions. We may also receive information about your interactions with our Website, such as which pages you visited and how much time was spent on the page.

We may collect this information using cookies or similar technologies. Cookies are pieces of information that are stored by your browser on the hard drive or memory of your device. Cookies enable us to personalize your experience on our Website, maintain a persistent session, passively collect demographic information, and monitor advertisements and other activities. Our Website may use different kinds of cookies and other types of local storage (such as browser-based or plugin-based local storage). Refer to your browser instructions or the help section of your browser to learn more about these functions. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Website. Unless you have adjusted your browser settings so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website.

Consent may be obtained by us from you when we receive Personal Information directly from you, or indirectly through others by use of our Services.

3. USE OF PERSONAL INFORMATION

We will use your Personal Information for the following purposes:

1. To register you for Services that we provide for you;
2. To assist you with completing transactions and accessing your account information;
3. For client identification purposes;
4. To comply with applicable legal, regulatory, or self-regulatory requirements for the prevention of fraud, anti-money laundering, and counter-terrorist-financing;
5. To communicate with you about your account and our Services;
6. To maintain, evaluate, and improve our Services and business operations in order to serve you better;
7. To notify you about the changes to our Website or any Services we provide through it;
8. To carry out our obligations and enforce our rights arising from any contracts with you, including for billing and collection, or to comply with legal requirements;
9. In any other way we may describe when you provide the information; and
10. For any other purpose with your consent.

By providing your Personal Information, you consent to our use of that information for the purposes described in this Policy, or for other purposes to which you have otherwise expressly consented.

4. DISCLOSURE OF PERSONAL INFORMATION

We may disclose Personal Information that we collect or you provide to:

1. our subsidiaries and affiliates;
2. to various third-party service providers we use to support our business;
3. in accordance with applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale of transfer of some or all of Ditrax’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our clients is among the assets transferred;
4. to fulfill the purpose for which you provide it;
5. for any other purpose disclosed by us when you provide the information; and
6. with your consent.

Prior to any disclosure of Personal Information to a third-party service provider, including but not limited to, Microsoft Corporation (OneDrive), Sum and Substance Ltd. (UK) (Sumsub), Advapay Canada, banking partners, and payment processors, we enter into a written agreement that:

1. obliges the service provider to protect Personal Information with security safeguards that are at least equivalent to those required under Canadian law;
2. limits the service provider to Processing Personal Information solely for the purposes identified by Ditrax;
3. mandates prompt notification to Ditrax of any actual or suspected data incident; and
4. permits Ditrax to audit, or have audited, the service provider’s compliance with the agreement.

In accordance with the law, we may also disclose your Personal Information to law enforcement agencies, regulatory bodies, or other governmental authorities if required to do so by law or if such disclosure is necessary for the establishment, exercise, or defence of a legal claim. We may also disclose your Personal Information to enforce or comply with our terms of use and if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our clients.

We transfer your Personal Information to parties outside of Canada, including but not limited to the United Kingdom, the United States of America, Cayman Islands, South Africa, Cyprus, Netherlands, Estonia, Ireland, and Czech Republic as permitted or required by applicable law, regulatory authorities, law enforcement, and government agencies. Additionally, when you send or receive money to or from another country, we will also be required to share some of your Personal Information with that country as required or permitted by law. We transfer certain Personal Information about you to our data centers located in the United Kingdom or within a region as required by local law and Process it to fulfil our legal and compliance obligations which apply to our Services. By continuing to use the Services, you explicitly consent to such cross-border transfers. Notwithstanding the foregoing, Ditrax takes contractual, technical, and organizational measures designed to ensure that any Personal Information transferred outside Canada continues to receive a level of protection comparable to that provided under Canadian privacy law.

5. CONSENT AND WITHDRAWAL OF CONSENT

We will only collect, use, or disclose your Personal Information with your knowledge and consent, except where otherwise authorized or required by law. You may withdraw your consent to the collection, use, or disclosure of your Personal Information at any time, subject to legal or contractual restrictions and reasonable notice. Please note that withdrawing your consent may limit our ability to provide the requested Services or otherwise engage with you.

6. RETENTION AND DESTRUCTION OF PERSONAL INFORMATION

We retain your Personal Information for the longer of: (i) the period required to fulfil the purposes for which it was collected; (ii) any statutory or regulatory period, including a minimum of five (5) years from date of collection for anti-money laundering and counter-terrorist-financing records; or (iii) the limitation period for any potential legal claims. Upon expiry of the applicable retention period, or if you request that your Personal Information be deleted, we will securely destroy it in a manner that prevents unauthorized parties from accessing, reading, or reconstructing any Personal Information. Under some circumstances, we may anonymize your Personal Information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent. Our compliance team will oversee all destruction of Personal Information.

7. SECURITY OF PERSONAL INFORMATION

The security of your Personal Information is very important to us. We employ industry-standard administrative, technical, and physical safeguards proportionate to the sensitivity of the Personal Information, including encryption, access controls, and monitoring. We also endeavour to limit access to your Personal Information to our employees, agents, and representatives on a need-to-know basis.

While we endeavour to maintain the highest standards of protection, no method of transmitting or storing data is entirely invulnerable. We cannot guarantee the security of information sent to or from our Website or systems, and you provide Personal Information at your own risk. We do not accept liability for unintentional disclosure and we are not responsible for the circumvention of any privacy settings or security measures contained on our Website.

8. ACCESS AND CORRECTION OF PERSONAL INFORMATION

It is important that the Personal Information we hold about you is accurate and current. Please keep us informed if your Personal Information changes. You have the right to request access to the Personal Information we hold about you and to request corrections if you believe that information is inaccurate or incomplete. To submit such requests, please contact us using the contact information below. We will respond to all reasonable requests for access and corrections in a timely manner, no more than seven (7) business days business days and in compliance with applicable law. Identification sufficient to verify the requester’s identity may be required.

Please note that applicable law may allow or require us to refuse to provide you with access to some or all of the Personal Information we hold about you, or we may have destroyed, erased, or made your Personal Information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal Information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

9. INTERNATIONAL USERS

If you are accessing or using our Services from outside Canada, please be aware that your Personal Information will be collected, used, and Processed in Canada and may also be transferred to, or accessed from, other jurisdictions where our service providers or business partners operate. We comply with PIPEDA and applicable Canadian privacy laws when handling your Personal Information, regardless of your country of residence. By using our Services, you acknowledge and consent to the collection, transfer, and Processing of your Personal Information in Canada and in other countries, which may have different data protection laws than your home jurisdiction. We take reasonable steps to ensure that your Personal Information is protected with safeguards comparable to those required under Canadian law, including through contractual agreements and security measures with our third-party service providers. If you have questions about how your Personal Information is handled or wish to exercise your privacy rights, please contact our Compliance Officer using the information provided in this Policy.

10. TRANSFER OF PERSONAL INFORMATION

Your Personal Information may be collected in Canada and subsequently transferred to, stored in, or otherwise Processed within jurisdictions outside Canada, including but not limited to the United Kingdom, the United States of America, Cayman Islands, South Africa, Cyprus, Netherlands, Estonia, Ireland, and Czech Republic. When we transfer Personal Information across borders, we do so in compliance with PIPEDA and any other applicable Canadian privacy legislation, and we take reasonable contractual, technical, and organizational measures to protect that information against unauthorized access, disclosure, alteration, or misuse. These measures include limiting transfers to service providers and business partners that have agreed in writing to provide a level of protection for Personal Information that is comparable to the safeguards required under Canadian law; conducting privacy and security assessments of such third parties; implementing industry standard encryption during transmission and at rest; and restricting access to Personal Information on a need-to-know basis. While Personal Information is located outside Canada it is subject to the laws of the foreign jurisdiction and may be accessible to courts, law enforcement, and national security authorities in that jurisdiction, but we will only disclose Personal Information in accordance with our obligations under PIPEDA and will use all reasonable legal means to resist any overbroad or inappropriate disclosure requests. By using our Services, you acknowledge that your Personal Information may be transferred to, Processed and stored in jurisdictions other than Canada, and you consent to such transfers in accordance with this Policy. Your Personal Information may be accessed for foreign authorities and Canadian law may not apply once data is transferred outside of Canada. If you have any questions about our cross-border transfer practices or the safeguards we apply, please contact our Compliance

11. CHILDREN’S PERSONAL INFORMATION

Our services are not directed and intended for use by individuals under the age of eighteen (18) or the age of majority in their jurisdiction, whichever is higher. If we learn that Personal Information of a minor has been collected, we will delete such data without undue delay, unless retention is required by law.

12. UPDATES TO THIS POLICY

We reserve the right to revise or update this Policy from time to time to reflect changes in our practices, legal obligations, or regulatory requirements. Any modifications will become effective thirty (30) days following notice to you via email and/or prominent posting on our Website. Your continued use of our Services following the effective date will constitute acceptance of the revised Policy.

13. BREACH NOTIFICATION

In the event of a privacy breach that poses a real risk of significant harm, Ditrax will, without unreasonable delay: (a) notify the Office of the Privacy Commissioner of Canada; (b) notify affected individuals with sufficient detail to understand the breach and steps they can take; and (c) keep a record of every breach of security safeguards for a minimum of twenty-four (24) months, in accordance with PIPEDA.

14. HANDLING PRIVACY COMPLAINTS

Ditrax is committed to addressing any concerns or complaints regarding the handling of your Personal Information in a prompt and respectful manner. If you have a complaint or concern about our privacy practices, please contact us using the details provided below. Upon receiving your complaint, we will acknowledge receipt, investigate the matter thoroughly, and respond to you within a reasonable timeframe. If your complaint is found to be justified, we will take appropriate steps to resolve the issue and, if necessary, amend our practices and procedures. If you are not satisfied with our response, you may also have the right to contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy authority for further assistance.

15. CONTACT US

If you have any questions, concerns, complaints, or requests relating to this Policy or our privacy practices, please contact us at:

Ditrax Financial Ltd.
Compliance Officer
130 Spadina Avenue, Unit 807D
Toronto, Ontario, Canada
M5V2L4

Attn: Michael Stahl at +1 (587) 658-0460

We will endeavour to address your enquiries promptly and provide any additional information or assistance required.

Last Updated: 20/10/2025